4bnode@4.2.2
4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has a targeted email setup path that automatically reports identifying user and project details to a hard-coded publisher address, without separate consent. This is suspicious runtime telemetry; the other flagged install and AI-provider flows appear tied to explicit project setup or user requests.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The user runs the add-email setup command and configures a `4brains.in` sender.
Impact
The publisher receives identifying information about the user and project without a separate confirmation of the report.
Mechanism
The command automatically sends the sender address, provider, OS username, hostname, app name, and timestamp through the configured mail provider to `pawan@4brains.in`.
AI rationale
The package has a targeted email setup path that automatically reports identifying user and project details to a hard-coded publisher address, without separate consent. This is suspicious runtime telemetry; the other flagged install and AI-provider flows appear tied to explicit project setup or user requests.
Evidence
add-email.jslib/codegen.js.envsrc/services/mailer.js
Network endpoints2
api.sancharak.com4brains.in (pawan@4brains.in)
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The email setup command gathers the configured sender address, OS username, hostname, app name, provider, and timestamp for a notification.
- When an `@4brains.in` sender is configured, the package sends that notification to the hard-coded address `pawan@4brains.in`.
- The notification is sent automatically after setup, without asking the user to confirm the report.
- The package also hard-codes the shared authorization password for configuring that sender domain.
Evidence against
- The notification is limited to configuring a `4brains.in` sender through the explicit `add-email` command.
- AI provider API keys are sent to their corresponding official provider endpoints when the user submits an AI plan request.
- The runtime npm install occurs during the explicit project scaffolding flow and installs the scaffold’s dependencies.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggedadd-email.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = 4bnode@4.1.9
matchedIdentity = npm:NGJub2Rl:4.1.9
similarity = 0.771
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
add-email.jsView on unpkg123patternName = generic_password
severity = medium
line = 123
Medium
skeleton/src/discovery.jsView file
34import os from "os";
L35: import { execFileSync } from "child_process";
L36:
High
Child Process
Package source references child process execution.
skeleton/src/discovery.jsFindings
1 Critical5 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltaadd-email.js
HighChild Processskeleton/src/discovery.js
HighShell
HighCross File Remote Execution Contextlib/codegen.test.js
HighRuntime Package Installindex.js
HighSemantic Analysis Limitedlib/codegen.test.js#virtual:normalized:round1
MediumSecret Patternadd-email.js
MediumDynamic Requireadd-bonjour.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to 4bnode@4.2.2.
See all versions of 4bnode for other recorded verdicts.
- Review the evidence and your use of 4bnode@4.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.